The realities of maintaining a secure software supply chain
summary
BlackBerry reports a centralized supply-chain program that tracks 563 libraries across 86 product variants, sometimes with up to 47 copies of the same library and 16 versions of one library in a product. A dedicated incident‑response and readiness review process plus in‑house tooling aggregates bills of materials into a master catalog, drives daily vulnerability checks, and enforces fixes; BlackBerry cites spending $370,000/year on OpenSSL and deploying Jarvis binary static analysis with ~400 dashboards.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:42Blackberrys Security Engineering Challenges
- 1:10Global Connected Software Supply Chain
- 1:43Open Source Software
- 2:37Maintaining Patching
- 5:59Quick Wins
- 7:51Technical Advice
- 12:20Ponemon Survey
- 18:12Automotive Attacks
- 20:39Security Engineering
- 26:06Watchdogs
- 27:12Integrity of Devices
- 28:38Practical Approaches
- 30:26Continuous Assessment
related talks
52mOSS Security Maturity: Time to Put on Your Big Boy Pants!
49mScaling Software Supply Chain Source Security in Large Enterprises
26mEffective Software Supply Chain Monitoring
24mDependency Track Fortifying The Supply Chain
41mThe Divine and Felonious Nature of Cyber Security
39mWhat is Rugged all About?
14mSupply Chain Security, why should I care?
11mVulnerability Supply Chains